CVE-2023-0240
CVSS V2 None
CVSS V3 None
Description
There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.
Overview
- CVE ID
- CVE-2023-0240
- Assigner
- cve-coordination@google.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-01-30T14:15:10
- Last Modified Date
- 2023-02-06T21:48:48
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 1 | OR | 5.10 |
References
| Reference URL | Reference Tags |
|---|---|
| https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y&id=788d0824269bef539fe31a785b1517882eafed93 | Mailing List Patch Vendor Advisory |
| https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49 | Patch Third Party Advisory |
| https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93 | Patch Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-0240 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0240 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 06:55:53 | Added to TrackCVE | |||
| 2023-04-17 06:55:55 | Weakness Enumeration | new |